An analyzer that analyzes a message transmitted between computers acquires a packet passing through a switch connected to the computer by mirroring or the like, and stores the acquired packet in a storage unit such as a packet buffer. In a case where the size of the message transmitted between the computers is larger than the size that may be accommodated in one packet as a unit of transmission, the message is divided into a plurality of parts, stored in each of a plurality of packets, and transmitted as a group of packets. The analyzer couples the divided message parts included in the packet group, whereby assembles the divided message parts into the original message, and analyzes the assembled original message (For example, see Japanese Laid-open Patent Publication No. 2014-042290).
For example, a device that transmits packets sets the transmission interval of the packets between different messages to be longer than the transmission interval of the packets within one and the same message. Utilizing this property, the packet analyzer determines that a packet whose reception interval is equal to or greater than a predetermined threshold value is a head packet of the packet group including the divided message to perform a message reception process (For example, see Japanese Laid-open Patent Publication No. 2011-182211).